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REMARKS 

Receipt is acknowledged of the Office Action of March 10, 2004. Claims 1-22, are 
currently pending in the application. In the Office Action, Claims 1-22 were rejected by the 
Examiner. Independent Claims 1, 5, 8, 11, 13, 17, 21 and 22 have been amended by the present 
Response. These amendments have been made to place the application in immediate condition 
for allowance. 

Applicants thank the Examiner for the courtesy extended during the personal interview 
conducted on May 11, 2004. Amendments discussed during the interview have been 
incorporated into the current claims. 

Claims 1-22 were rejected in the Office Action. Applicants have amended independent 
Claims 1, 5, 8, 11, 13, 17, 21 and 22 to more particularly claim the AppHcants' invention. 
Claims 1, 5, 8, 13 and 17 now recite a security system for a target network of computers 
including at least one security subsystem (or detection means) associated with the target network, 
the security subsystem monitoring and analyzing for security events across a plurality of devices 
associated with the computer network, detecting attacks on the network and responding to the 
detected attacks. The security subsystem responds to the detected attacks by selectively 
reporting a status of said target network to a master system, testing the target network and/or 
implementing countermeasures. The security system of the claimed invention further includes a 
master system which analyzes the security subsystem by at least testing the subsystem; allows 
the subsystem to respond to the detected attacks by selectively reporting, testing and 
implementing countermeasures; and registers information pertaining to attacks detected by the 
subsystem. (Support for the above amendments can be found on page 8, lines 10-26 of the 
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originally filed specification) As more particularly discussed below, prior art references cited by 
the Examiner do not disclose the security system as claimed in the present application. 
Particularly, the limitation of the security subsystem "being configured to monitor and analyze 
for security events across a plurality of devices associated with said network of computers, to 
detect attacks on said computer and to respond to said detected attacks ... by selectively 
reporting a status of said network of computers to said master system, testing said network of 
computers and implementing countermeasures" is not found in any of the cited references. 
Additionally, the limitation of the master system analyzing the security subsystem "by at least 
testing said security subsystem" and allowing "said subsystem to respond to said detected attacks 
by selectively reporting, testing and implementing countermeasures," is not found in any of the 
cited references. Accordingly, Claims 1, 5, 8, 13 and 17 are believed to be patentable over the 
prior art of record. Moreover, dependent Claims 2-4, 6-7, 9-10, 14-16 and 18 are believed to 
define patentable subject matter in view of their dependency upon allowable Claims 1, 5, 8, 13 or 
17 and, further, on their own merits. 

Claims 11,21 and 22 now recite a method for monitoring the integrity of a security 
subsystem associated with a target network of computers and configured to detect attacks on said 
network of computers including the steps of monitoring and analyzing for security_events across 
a plurality of devices associated with said target network, detecting and registering attacks on 
said target network using said security subsystem; responding to said detected attacks by 
selectively reporting a status of said target network fi-om said security subsystem to said master 
system, testing said target network using said security subsystem and implementing 
coimtermeasures by said security subsystem; establishing a secure link for the transfer of data 
between said security subsystem and a master system hierarchically independent fi"om said 
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security subsystem; analyzing the status of said security subsystem through said secure link by at 
least testing said security subsystem; and registering information pertaining to the status of said 
security subsystem. (Support for the above amendments can be foimd on page 8, lines 10-26 of 
the originally filed specification) As more particularly discussed below, prior art references cited 
by the Examiner do not disclose the method as claimed in the present application. Particularly, 
the limitation of "responding to said detected attacks by selectively reporting a status of said 
target network fi-om said security subsystem to said master system, testing said target network 
using said security subsystem and implementing countermeasures by said security subsystem," is 
not found in any of the cited references. Accordingly, Claims 11,21 and 22 are believed to be 
patentable over the prior art of record. Moreover, dependent Claim 12 is believed to define 
patentable subject matter in view of its dependency upon allowable Claim 1 1 and, further, on its 
own merits. 

In the outstanding Office Action, the Examiner has made numerous grounds of rejection. 
The main ground of rejection, which is the sole ground of rejection against independent Claims 
1, 5, 11, 13, 17,21 and 22, consists of the rejection of Claims 1, 3, 5-6, 11, 13, 15, 17, 19 and 21- 
22 under 35 U.S.C. 103(a) as allegedly being unpatentable over the Messmer publication in view 
of the Newton's Telecom Dictionary and fiirther in view of the Livermore reference. In making 
this ground of rejection, the Examiner has first relied upon Messmer to show that it teaches that 
the black box located on the company network "is configured to correlate events across a 
plurality of devices associated with the network of computers because Messmer teaches that a 
probe or "black box sensor" is put on the customer's network to accept audit data fi-om a wide 
range of devices." Additionally, relying on the Newton's Telecom Dictionary, the Examiner 
accreted that the encryption taught in Messmer is equivalent to the "secure Unk" limitation of 
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Applicants Claims. In making the ground of rejection, the Examiner has conceded that Messmer 
and the Dictionary do not show a master system performing without a human control. The 
Examiner relied on Livermore to anticipate this limitation (currently deleted from the claims) of 
Applicants claims. In other words, the Examiner suggests that the humanly operated master 
system of Messmer can be simply substituted by an automated detection system suggested (but 
not described) in Livermore. 

Although the above rejection is no longer apphcable to the amended claims pending in 
the Application, Applicants remind the Examiner that the Patent and Trademark Office has the 
initial burden of producing a factual basis for a rejection under 35 U.S.C. § 103. In other words, 
the Patent and Trademark Office must establish a prima-facie case for obviousness. If 
examination does not produce a prima-facie case of unpatentability under § 103, then without 
more, the applicant is entitled to a grant of the patent. In re Oetiker, 977 F.2d 1443, 1445, 24 
USPQ 2d 1443, 1444 (Fed. Cir. 1992). The issue of the prima-facie case for obviousness was 
recently visited by the Federal Circuit in In re Thrift, 63 USPQ 2d 2002. In that case, the Federal 
Circuit stated the following: 

"To establish a prima-facie case of obviousness the Board must, inter alia, show 
some objective teaching in the prior art or that knowledge generally available to 
one of ordinary skill in the art would lead that individual to combine the 
relevant teachings of the references.' In re Fine, 837 F.2d 1071, 1074, 5 USPQ 
2d 1596, 1598 (Fed. Cir. 1988). 'The motivation, suggestion or teaching may 
come explicitly from statements in the prior art, the knowledge of one of 
ordinary skill in the art, or, in some cases, the nature of the problem to be 
solved.' In reKotzab, 111 F.3d 1365, 1370, 15 USPQ 2d 1313, 1317 (Fed. Cir. 
2000)." 63 USPQ 2d at 2006. 

In the well known case. In re Gordon, 221 USPQ 1 125 (Fed. Cir. 1984), the Court 
addressed the issue of whether a case for prima-facie obviousness had been established. In that 
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case, the Examiner sought to apply U.S. Patent No. 1,175,948 to French which discloses "a 
liquid strainer for removing dirt and water from gasoline and other like oils." 221 USPQ at 
1 127. In the French strainer, disclosure is made that the straining action relies "at least in part, 
upon the assistance of gravity to separate undesired dirt and water from gasoline and other like 
oils." Id. In attempting to apply the French patent against the claims on appeal, the Examiner 
proposed inverting the French strainer. The Federal Circuit concluded that such a ground of 
rejection failed to establish prima-facie obviousness. Id. The Court stated that: 

"[T]he mere fact that the prior art could be so modified would not have made the 
modification obvious unless the prior art suggested the desirability of the 
modification." Id. 

"Indeed, if the French apparatus were turned upside down, it would be rendered 
inoperable for its intended purpose. The gasoline to be filtered would be 
trapped in pocket 9, and the water French seeks to separate would flow freely 
out of the outlet 5. Further, unwanted dirt would build up in the space between 
the wall of shell 1 and screen 21, so that, in time, screen 21 would become 
clogged unless a drain valve, such as pet-cock 13, were re-introduced at the 
new 'bottom' of the apparatus. . . In effect, French teaches away from the 
Board's proposed modification. Because the PTO has failed to establish a 
prima-facie case of obviousness, the rejection of Claims 1-3 and 5-7 as 
unpatentable under 35 U.S.C. § 103 must be reversed, " Id. 

Thus, in In re Gordon, the Federal Circuit held that where the prior art applied against 
the claims on appeal, as applied, was rendered inoperable for its intended purpose, no prima- 
facie case for obviousness had been established. 

If the Primary Examiner has established a case for prima-facie obviousness, the burden 
then shifts to the applicant to demonstrate why the claims are unobvious. See Patents and the 
Federal Circuit, Edition, by Robert L. Harmon, § 4.7(b), page 185. 

In Graham v. John Deere Co., 383 US 1, 148 USPQ 459 (1966), the U.S. Supreme Court 
announced the test that has since become the standard guideline for assessing patentability under 
35 U.S.C. § 103. Under that section of the Patent Statutes, the Supreme Court stated that the 
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inquiry was as follows: 


"The scope and content of the prior art are to be determined; differences 
between the prior art and the claims at issue are to ascertained; and the level of 
ordinary skill in the pertinent art resolved. Against this background, the 
obviousness or nonobviousness of the subject matter is determined." 383 US at 
17. 


The inquiry as to when the issue of obviousness is to be resolved is that the inquiry is 
conducted "at the time the invention was made." 35 U.S.C. § 103(a). In attempting to reject 
claims under 35 U.S.C. § 103, there must be a reason or suggestion in the art for making the 
combination of features suggested by the Examiner other than knowledge learned from 
applicant's own disclosure. In re Dow Chemical Co,, 837 F.2d 469, 473, 5 USPQ 2d 1529, 1532 
(Fed. Cir. 1988). The test to be applied is whether the references taken as a whole would suggest 
the invention to one of ordinary skill in the art. Medtronic Inc. v. Cardiac Pacemakers, Inc, 721 
F.2d 1563, 1582, 220 USPQ 97, 1 10 (Fed. Cir. 1983). Focusing on the obviousness of 
substitutions and differences, instead of on the invention as a whole, is a legally improper way to 
simplify the often difficult determination of obviousness. Gillette Company v. S.C Johnson & 
Son, Inc., 16 USPQ 2d 1923, 1927 (Fed. Cir. 1990). A determination of obviousness must * 
involve more than indiscriminately combining prior art; a motivation or suggestion to combine 
must exist. Micro Chemical, Inc. v. Great Plains Chemical Company, 41 USPO 2d 1238, 1244 
(Fed. Cir. 1997). Inherent in the forbiddance of the use of hindsight is the forbiddance of picking 
and choosing various features of different prior art references as a mosaic to recreate a facsimile 
of the claimed invention without a suggestion to combine them together in the references taken 
as a whole. ^Azo TV.y. v. United States ITC, 808 F.2d 1471, 1481, lUSPQ2d 1241, 1246 (Fed. 
Cir. 1986). Where the Examiner has picked and chosen various features from separate prior art 
references and has combined them together using applicant's own disclosure as the blueprint to 
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do so, such a rejection is fatally flawed and must be reversed. Heidelberger Druckmaschinenag 
V. Hantscho Commercial Products, Inc., 21 F.3d 1068, 1072, 30 USPQ 2d 1377, 1379-80 (Fed. 
Cir. 1994); In re Geiger, 815 R2d 686, 688, 2 USPQ 2d 1276, 1278 (Fed. Cir. 1987). It is 
improper to use the inventor's patent application as an instruction book on how to reconstruct the 
prior art. Panduit Corp. v. Dennison Mfg. Co., 810 F.2d 1561, 1574, 1 USPQ 2d 1593, 1602 fh29 
(Fed. Cir. 1987). 

It is a tenet of patent law that an invention that otherwise might be viewed as an obvious 
modification of the prior art will not be deemed obvious in a patent law sense when one or more 
prior art references "teach away" from the invention. Chi sum on Patents, § 5.03[3] [a] [i] [G]. 

In W.L. Gore & Associates, Inc. v. Garlock, Inc., 220 USPQ 303, 310 (Fed. Cir. 1983), 
the Federal Circuit found that the District Court had erred "in considering the references in less 
than their entireties, i.e., in disregarding disclosures in the references that diverge from and teach 
away from the invention at hand.", citing In re Kuderna, 165 USPQ 575 (CCPA 1970). Prior art 
references must be considered in their entireties in an obviousness inquiry and must include a 
"full appreciation of what such reference fairly suggests to one of ordinary skill in the art." 
American Standard, Inc. v. Pfizer, Inc., 14 USPQ 2d 1673, 1706 (D.C.Del. 1989). Although 
each reference used in an obviousness inquiry does not have to be enabling, disclosures in the 
references that "teach away" from the claimed invention cannot be disregarded. American 
Standard, Inc., 14 USPQ 2d at 1707, citing W.L. Gore, 

A prior art reference may be considered to teach away when: 


"a person of ordinary skill upon reading the reference, would be discouraged from 
following the path set out in the reference, or would be led in a direction divergent 
from the path that was taken by the applicant." 

Monarch Knitting Machinery Corp. V. Suher Morat, GmbH, 45 USPQ 2d 1977, 1984, 
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citing In re Gurley, 3 1 USPQ 2d 11 30, 1 1 3 1 (Fed. Cir. 1 994). There is no suggestion to combine, 
however, if a reference teaches away from its combination with another source. Tec Air, Inc, v. 
Denso Manufacturing Michigan, Ina, 52 USPQ 2d 1294, 1298 (Fed. Cir. 1999), also citing re 
Gurley. 

With respect to the presently claimed invention. Applicants believe that Messmer can not 
be modified or combined with any other prior art reference of record to render the amended 
claims of the AppUcation obvious. Specifically, because Messmer's "black box" is a "dumb box" 
simply passing information through, it can not be modified to monitor and analyze for security 
events across a plurality of devices associated with a computer network, detect attacks on the 
network and respond to the detected attacks by selectively reporting a status of said target 
network to a master system, testing the target network and/or implementing countermeasures. 
Therefore, Claims 1-22 incorporating the above limitation are believed to define patentable 
subject matter. As such, reconsideration and allowance of this application are respectfully 
sohcited. 

If, for any reason, the Examiner believes that an interview with Applicant's Attorney 
would be helpful in expediting the prosecution of this patent application, the Examiner is 
respectfully requested to telephone Applicant's Attorney at (212) 756-2167 so that a discussion 
of any outstanding issues may be had. 

In view of the above, the Applicant submits that the disclosed invention is patentable 
over the prior art. The Patent and Trademark Office is authorized to charge any fees required for 
the entry of this Response, including fees for an extension of time, and any further fees that are 
properly assessable in this case, or to credit any overpayment, to Deposit Account No. 50-0675, 
Order No. 881075-0003. In the event that an extension of time is needed for entry of this 
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Response that is not otherwise provided for, such extension of time is hereby respectfully 


requested. 


Respectfully submitted, 

SCHULTE ROTH & ZABEL LLP 

Attorneys for Applicants 

919 Third Avenue 

New York, New York 10022 

(212) 756-2000 


Dated: May 25, 2004 

New York, New York 



Anna Vishev 
Reg. No. 45,018 
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